"Funner" Worm Removal

Please see the "Funneh page" if you are sending out links like this:
http://www.fightbac.com/files/Funneh.exe

I received my first emails about the Funner worm on April 18, 2005:

The virus inserts the following link into every new message you create:

  1. "http://www.fightbac.com/files/Funny.exe"

As usual, AIMFix will remove this if you have the most recent AIMFix. If it still does not remove the virus for you, please contact me with a log file from HijackThis so I can update AIMFix to help you out.

I also recommend that you download and install "Mike's Ad Blocking Hosts File" to both block ads and remove the infected hosts file from your machine (Funner worm edits the hosts file). Get the Ad Blocking Hosts File. You can also use HostFix to recreate a default hosts file.

Manual Removal Instructions:
The manual removal should be entirely unnecessary, as AIMFix works for almost every single person. However, if it does not work for you, you can follow these steps:

Please note: for the purposes of these instructions, it is assumed that you have Windows installed to C:\, also known as your "C drive". If you for some reason have Windows installed elsewhere, obviously, you will need to substitute that drive letter (such as F, or Y or whatever) for "C" in the directions. Also, if you run windows 2000, it may be Winnt in place of the Windows folder. (Each "\" after a folder name means it's a folder inside that folder. So, C:\Windows\System means a folder called System, inside a folder called Windows, inside the "C" drive)

  1. You will need to first download the removal tool, which is provided HERE.Please do NOT select "open" when you click the link, but save it to your hard drive, preferably to your desktop so that you can find it later.
  2. Run the removal tool (you may wish to try this twice if it fails the first time) If the removal tool fails, please boot into Safe Mode (without networking) and try running the tool in safe mode. For instructions on booting into Safe Mode, click here.
  3. For manual removal of the virus files, you will need to first make sure youa re in Safe Mode (see above). Next, you will need to show all hidden files, since most virus files are marked hidden so they are not visible to you normally.
  4. To unhide files, click on the Tools menu in Explorer, then click Folder Options, and go to the View tab. (if you are on 98 this will be in the View menu) Now check the box next to "show hidden files and folders" and uncheck the "Hide protected operating system files" box. Now choose "apply to all folders" and click apply. The files are usually located in C:\Windows\System or C:\Windows\System32, though it varies on computer to computer.
  5. In this case, delete C:\funny.exe, and any of the following files:
    • ADMLN.exe
    • MSADMLN.exe
    • Explore.exe (NOT explorer.exe, EXPLORE.exe, BIG difference between those two, don't mess it up)
  6. Unless I give a specific path to the file, like C:\Path\To\Someplace\virusfile.exe, then the files are probably in C:\Windows or Windows\System32 - again, unhide the files and look around, or use the file search, but be aware that on Windows XP it will not search hidden files or System directories by default, you need to enable that in the advanced options for searching.

IMPORTANT: after removing the virus, you will probably have spyware that needs to be removed. See the spyware page for detailed instructions on removing spyware.

contact me

LEGAL STUFF: I am not affiliated with the makers of this virus in any way, nor am I affiliated with any anti-virus company. I merely provide this as a service for those who have been infected. I take no responsibility for any damage done by the virus or by those incorrectly following these removal steps, or those using my removal tools.

Main Page